November Spotlight Breach: What the ASOS Hack Teaches Us About Trust

What Happened? 

Imagine opening your favourite shopping app and seeing a notification telling you the company has been hacked. Except the message hasn’t come from the company, it’s been sent by the hackers themselves. 

That’s exactly what happened to ASOS customers on 6 October 2026, when cyber criminals used the retailer’s own app notification system to announce that they’d compromised its systems. 

The notification caused immediate concern, and ASOS subsequently confirmed that an unauthorised third party had accessed customer information. Initially, the company said basic personal details, including names and contact information, may have been affected. 

But as the investigation continued, the picture became more concerning. After the criminals contacted BBC News with a sample of the stolen information, ASOS confirmed that more detailed customer profiles had been taken. According to the BBC, the stolen information included names, addresses, phone numbers, email addresses, customer numbers and dates of birth. Even customers’ shopping searches were visible in the data. 

ASOS hasn’t confirmed exactly how many customers were affected, although the breach could potentially involve millions of people. The company said it didn’t believe payment card information or account passwords had been accessed, and reassured customers that its website and app remained safe to use. 

So how did the attackers get in? According to ASOS, the criminals impersonated a trusted contact and persuaded an employee to hand over their login credentials. Those credentials then gave the attackers access to a service containing customer information. 

That’s what makes this incident particularly interesting. The attackers managed to exploit trust at two different points: first to gain access through an employee, and then by using a legitimate communication channel to reach customers directly. 

How One Convincing Impersonation Opened the Door 

Most employees wouldn’t deliberately hand their login details to a cyber criminal, but when someone appears to be a genuine colleague or trusted contact, an unexpected request can feel perfectly reasonable. 

That’s the problem with social engineering; attackers don’t always need to find a technical weakness when they can persuade someone with legitimate access to do something on their behalf. 

In the ASOS incident, the attackers reportedly gained access by impersonating someone the employee believed they could trust. We don’t know all the details of that interaction, but we do know the outcome: the attackers obtained working credentials and used them to access customer information. 

It’s easy to look at an incident like this and wonder why someone would share their login details, but attackers deliberately create situations that make unusual requests seem normal, particularly when they’re posing as someone familiar or in a position of authority. 

For an employee trying to get through a busy working day, a convincing request from a supposed colleague might not immediately raise concerns. 

That’s why security awareness needs to go beyond telling people to keep their passwords safe. Employees need to understand how impersonation works, recognise when a request deserves a second look and feel comfortable checking someone’s identity before sharing sensitive information. 

When the Message Comes from a Trusted Source 

The stolen customer information is obviously a serious concern, but there’s another part of this breach that deserves attention. 

The hackers were able to send a notification through the genuine ASOS app. When a notification pops up from an app you’ve downloaded and used for years, you probably don’t spend much time questioning who’s sent it, you just assume it’s come from the company behind the app. After all, they’re arriving through a service we’ve already downloaded and chosen to trust. 

In this case, the criminals used that familiarity to put their message directly in front of ASOS customers. 

It’s an interesting example of how trust can be exploited beyond the usual phishing email. An attacker doesn’t necessarily need to create a convincing fake website or spoof an email address if they’ve gained access to a genuine communication system. 

And while the ASOS notification announced the breach rather than posing as an ordinary customer service message, the wider implications are worth considering. If criminals can misuse a legitimate communication channel, people may be more inclined to believe a malicious request simply because of where it appears. 

The National Cyber Security Centre (NCSC) has specifically warned ASOS customers to be cautious of suspicious links, including those delivered through push notifications. 

It’s a useful lesson for employees too. A message appearing in a familiar place doesn’t automatically make it safe, particularly if it’s asking you to share information or take an unexpected action. 

What ASOS Did Well 

ASOS faced an unusual situation, with criminals effectively announcing the incident to customers before the company had completed its investigation. 

ASOS moved to restrict access to the affected third-party platforms and brought in external cyber security experts to investigate the incident. The retailer also confirmed that it was working with law enforcement and regulators, while keeping customers informed about the information believed to be affected. As more details emerged, it updated its messaging to explain that more extensive customer profiles had been accessed. 

That distinction matters. The initial description of basic contact information didn’t capture the full extent of what had been taken, and customers needed to understand the additional risks associated with their personal information being exposed. 

ASOS also reassured customers that it didn’t believe payment details or passwords had been compromised, and warned them to be cautious of unexpected messages or calls claiming to come from the retailer. 

Importantly, it made clear that customers would never be asked to share passwords, security codes or payment information through an unsolicited message or call. 

There’s a lesson here about communicating during an ongoing investigation. Organisations won’t always have every answer immediately, particularly when an incident is still unfolding, but keeping people informed as new information becomes available can help them understand what’s happened and what they should look out for next. 

What Organisations Can Learn 

One of the most striking things about the ASOS breach is how much damage a convincing impersonation can potentially cause. The attackers reportedly started by persuading an employee to share their login credentials. From there, they were able to access customer information and misuse a communication channel that millions of people would normally associate with a trusted retailer. 

That raises an important question for organisations: how confident are your employees when it comes to recognising someone who isn’t who they claim to be? 

When you’re busy getting on with your job, it’s easy to take a request at face value, especially when it appears to come from someone you know or trust. That’s exactly what attackers are counting on. 

Employees need to know that it’s okay to question those requests, even when they appear to come from someone they recognise. Checking through a separate, trusted channel can help establish whether a request is genuine before any sensitive information changes hands. 

The incident also shows why security awareness needs to keep up with the ways criminals communicate. Phishing emails are still a major concern, but employees can also encounter suspicious requests through workplace messaging platforms, phone calls and other familiar channels. 

The NCSC’s advice following the ASOS breach reinforces that point. Customers have been encouraged to watch for scams, avoid suspicious links and review their account security, recognising that malicious communications can arrive some time after the original incident. 

And when something does seem wrong, employees should know exactly how to report it. A quick report about an unusual request could give security teams the opportunity to investigate before an attacker gets any further. 

Ultimately, people need to feel confident questioning requests that don’t seem quite right, regardless of who appears to be making them. The more familiar employees become with the tactics attackers use, the better prepared they’ll be when a convincing impersonation attempt comes their way. 

Help Employees Recognise the Person Behind the Message 

When an attacker convincingly impersonates someone an employee trusts, even a simple request can become a serious security risk. 

MetaCompliance helps organisations prepare employees for these situations through engaging security awareness training that explains how social engineering works and helps people recognise the tactics criminals use to gain their trust. 

Our advanced phishing simulations give employees the opportunity to practise responding to realistic threats, helping them become more confident identifying suspicious requests. Relevant follow-up training can then reinforce the warning signs they missed and support stronger security behaviours over time. 

By making awareness training relevant to the situations employees encounter, organisations can help people develop the confidence to stop, check and verify before responding to an unexpected request. 

Get in touch to find out how MetaCompliance can help your organisation build stronger defences against social engineering.